Watch Floor
State-backedSouth KoreaMITRE G0126

Higaisa

0mentions, 7 days
0mentions, 30 days
nonelast mentioned

The organization often uses important North Korean time nodes such as holidays and North Korea to conduct fishing activities. The bait includes New Year blessings, Lantern blessings, North Korean celebrations, and important news, overseas personnel contact lists and so on. In addition, the attack organization also has the attack capability of the mobile terminal. The targets of the attack also include diplomatic entities related to North Korea (such as embassy officials in various places), government officials, human rights organizations, North Korean residents abroad, and traders. The victim countries currently monitored include China, North Korea, Japan, Nepal, Singapore, Russia, Poland, Switzerland, etc.

Targets: Government, China, North Korea, Japan, Nepal, Singapore, Russia, Poland, Switzerland

CVEs in recent coverage

No CVEs named alongside this actor in the last 90 days.

Recent victims

No leak-site posts on record for this group.

ATT&CK techniques

T1001.003 Protocol or Service ImpersonationT1016 System Network Configuration DiscoveryT1027.001 Binary PaddingT1027.013 Encrypted/Encoded FileT1027.015 CompressionT1029 Scheduled TransferT1036.004 Masquerade Task or ServiceT1041 Exfiltration Over C2 ChannelT1053.005 Scheduled TaskT1057 Process DiscoveryT1059.003 Windows Command ShellT1059.005 Visual BasicT1059.007 JavaScriptT1071.001 Web ProtocolsT1082 System Information DiscoveryT1090.001 Internal ProxyT1106 Native APIT1124 System Time DiscoveryT1140 Deobfuscate/Decode Files or InformationT1203 Exploitation for Client ExecutionT1204.002 Malicious FileT1220 XSL Script ProcessingT1547.001 Registry Run Keys / Startup FolderT1564.003 Hidden WindowT1566.001 Spearphishing AttachmentT1573.001 Symmetric CryptographyT1574.001 DLLT1680 Local Storage Discovery

Recent activity

No posts or advisories have named this actor recently.

References

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.